topic Re: How Palo alto APP ID functions to identify applications when it receives encrypted traffic ? in General Topics

How Palo alto APP ID functions to identify applications when it receives encrypted traffic ?

perumalj — Fri, 15 Jul 2022 14:37:03 GMT

I would like to know how APP ID works when Palo alto firewall receives encrypted traffic but no ssl decryption is enabled.

Re: How Palo alto APP ID functions to identify applications when it receives encrypted traffic ?

BPry — Fri, 15 Jul 2022 16:11:39 GMT

@perumalj,

The firewall still has limited insight into traffic even when you don't decrypt it. The accuracy of app-id goes down as we don't have full insight into the traffic, but that doesn't mean you can't identify some base IDs. Facebook and Google are prime examples of this; they'll show up as facebook-base and google-base even if you aren't decrypting the traffic, because you can still gather limited insight into where that traffic is going.

So in short, the firewall still has limited insight into encrypted traffic and will do its best to identify that traffic appropriately.

Re: How Palo alto APP ID functions to identify applications when it receives encrypted traffic ?

aleksandar.astardzhiev — Fri, 15 Jul 2022 17:26:31 GMT

Hey @perumalj,

Probably the most common example for insight that @BPry has explained is the SNI (server name indicator) in SSL/TLS negotiation.